# GhostBoard plugin documentation

> Documentation for building, packaging, signing and distributing high-trust GhostBoard plugins with @ghostboard/sdk.

Full text of every page: https://ghostboard.21blog.com/docs/llms-full.txt

## Start

- [What a GhostBoard plugin is](https://ghostboard.21blog.com/docs/start/overview/): High-trust JavaScript that you install and enable explicitly, with a host-provided SDK for notes, canvas, files and panels.
- [Install and enable a plugin](https://ghostboard.21blog.com/docs/start/install-and-enable/): How end users install a package from a file or URL, review it, enable it per workspace, and remove it.
- [Build your first plugin in 15 minutes](https://ghostboard.21blog.com/docs/start/first-plugin/): Scaffold a command + panel plugin, connect it as a development directory, edit with live reload, test without the app and package it.

## Guides

- [Commands](https://ghostboard.21blog.com/docs/guides/commands/): Register menu entries with optional shortcuts, keep behavior in one function, and respect the activation lifecycle.
- [Panels](https://ghostboard.21blog.com/docs/guides/panels/): Side views rendered with plain DOM or with the host's shared React 19, styled with public theme variables.
- [Custom canvas types](https://ghostboard.21blog.com/docs/guides/canvas-types/): Register a new kind of card with validated, versioned state, a summary for search and export, and migrations with host backups.
- [CSV importer](https://ghostboard.21blog.com/docs/guides/csv-importer/): Turn a user-selected file into Notes through the host-owned select, map, preview, confirm and retry workflow.
- [Notes, storage and events](https://ghostboard.21blog.com/docs/guides/content-and-storage/): Read and write Notes in revision-checked, undoable transactions; keep JSON state per app or workspace; react to content, selection and workspace events.

## Reference

- [SDK reference](https://ghostboard.21blog.com/docs/reference/sdk/): The complete single-file @ghostboard/sdk reference, generated from the published package.
- [manifest.json (v2)](https://ghostboard.21blog.com/docs/reference/manifest/): Every field of the closed manifest v2 schema, with validation rules and what happens on rejection.
- [CLI: create-ghostboard-plugin and ghostboard-plugin](https://ghostboard.21blog.com/docs/reference/cli/): The scaffold command and the deterministic packer/signer that ship on npm.

## Distribution

- [Packaging](https://ghostboard.21blog.com/docs/distribution/packaging/): Produce a deterministic, installable archive that contains only runtime files and needs no tools on the user's machine.
- [Signing and updates](https://ghostboard.21blog.com/docs/distribution/signing-and-updates/): Create an author key, sign packages, publish a release document over HTTPS, and understand what trust-on-first-use pinning does and does not promise.
- [Testing without GhostBoard](https://ghostboard.21blog.com/docs/distribution/testing/): Use the in-memory fake host and the React test helper for author tests, and know what only a packaged app can verify.
- [Example packages](https://ghostboard.21blog.com/docs/distribution/examples/): Four signed, installable example plugins built with the public toolchain, hosted over HTTPS for URL installs and update checks.

## Policy and limits

- [Compatibility policy](https://ghostboard.21blog.com/docs/policy/compatibility/): How host, manifest, SDK and scaffold versions relate, what stays stable within a host major, and how data and updates stay compatible.
- [Supported platforms and limits](https://ghostboard.21blog.com/docs/policy/support-and-limits/): Which platforms and install sources are verified, and the behaviors GhostBoard explicitly does not promise for high-trust plugins.
- [Safe mode and recovery](https://ghostboard.21blog.com/docs/policy/safe-mode-and-recovery/): What happens when a plugin, package, update or migration goes wrong, and how users always keep control of plugin management and their data.